@tollbooth-dpyc/web 0.1.0 → 0.3.0

package/README.md

@@ -9,8 +9,10 @@ features. It is the peer of the `tollbooth-dpyc` Python wheel.
   kind-27235 inline proof when the tab holds a session key
 - **MCP client** — one shared connection to the operator, typed wrappers for
   the standard tools (balance, top-up, statement, price, profile)
-- **React components** — `NpubGate`, `NostrProfilePanel`, `WalletCard`,
-  `AvatarPicker`, `useSession`
+- **React components** — `NpubGate`, `NostrProfilePanel`, `SessionKeyClaim`, `WalletCard`,
+  `AvatarPicker`, `DebugPanel`, `useSession`, `useDebugLog`
+- **Debug log** — every call, result and error from `callTool`, scrubbed of
+  nsecs, hex keys, tokens and proofs before it is stored
 - **Pages proxy** — the `/mcp` Cloudflare Pages Function
 
 ## Use
@@ -39,6 +41,26 @@ import { makeMcpProxy } from "@tollbooth-dpyc/web/pages-proxy";
 export const onRequest = makeMcpProxy("https://chartremotely-mcp.fastmcp.app/mcp");
 ```
 
+### Debug panel
+
+`callTool` logs to a shared, scrubbed ring buffer; `DebugPanel` shows it as a
+bar along the bottom of the page with Copy and Clear. Put it once near the root.
+Anything the site alone needs goes in as children, drawn above the log:
+
+```tsx
+import { configureDebugLog, debugPush } from "@tollbooth-dpyc/web";
+import { DebugPanel } from "@tollbooth-dpyc/web/react";
+
+configureDebugLog({ persist: true });   // optional: outlive a reload; max defaults to 200
+
+<DebugPanel>
+  <button onClick={loadSchedulerRuns}>Scheduler ↻</button>
+</DebugPanel>
+```
+
+A site's own `debugPush` lines are scrubbed the same way. Stamps follow the
+zone the site stores under `<prefix>:timezone`, if any.
+
 ### Styling
 
 Components use Tailwind classes coloured only through CSS variables. Tell

package/dist/avatar.d.ts

@@ -5,7 +5,10 @@
  * is not, so a glyph pick stays local. A change dispatches a window event so
  * every avatar on the page updates without a reload.
  */
-export declare const AVATAR_CHOICES: string[];
+/** The glyphs offered when a site names none of its own. */
+export declare const DEFAULT_AVATAR_CHOICES: string[];
+/** This site's glyphs — `configureTollbooth({ avatarChoices })`, or the defaults. */
+export declare function avatarChoices(): string[];
 export declare const AVATAR_EVENT = "tollbooth:avatar-changed";
 /** http(s) or data:image renders as an image; anything else as a glyph. */
 export declare function isAvatarUrl(value: string): boolean;

package/dist/avatar.js

@@ -5,15 +5,22 @@
  * is not, so a glyph pick stays local. A change dispatches a window event so
  * every avatar on the page updates without a reload.
  */
+import { tollboothConfig } from "./config.js";
 import { fetchProfile } from "./nostrProfile.js";
 import { readStored, writeStored } from "./storage.js";
-export const AVATAR_CHOICES = [
+/** The glyphs offered when a site names none of its own. */
+export const DEFAULT_AVATAR_CHOICES = [
     "🐂", "🐻", "🦂", "🦅", "🐺", "🦉",
     "🦊", "🐉", "🦄", "🐢", "🦈", "🦀",
     "🎩", "🎭", "🃏", "🎯", "🪙", "💎",
     "⚡", "🔥", "🌪️", "🌊", "🏔️", "🌋",
     "♟️", "♛", "🛡️", "⚔️", "🗝️", "📜",
 ];
+/** This site's glyphs — `configureTollbooth({ avatarChoices })`, or the defaults. */
+export function avatarChoices() {
+    const own = tollboothConfig().avatarChoices;
+    return own?.length ? own : DEFAULT_AVATAR_CHOICES;
+}
 export const AVATAR_EVENT = "tollbooth:avatar-changed";
 /** http(s) or data:image renders as an image; anything else as a glyph. */
 export function isAvatarUrl(value) {
@@ -39,7 +46,8 @@ export function defaultAvatar(npub) {
     let h = 0;
     for (const c of npub)
         h = (h * 31 + c.charCodeAt(0)) >>> 0;
-    return AVATAR_CHOICES[h % AVATAR_CHOICES.length];
+    const choices = avatarChoices();
+    return choices[h % choices.length];
 }
 export function avatarFor(npub) {
     return getStoredAvatar(npub) || defaultAvatar(npub);

package/dist/config.d.ts

@@ -27,10 +27,13 @@ export interface TollboothConfig {
     extraBootstrapTools?: string[];
     /** Tools too routine to log in the debug panel. */
     quietTools?: string[];
+    /** Avatar glyphs in this site's voice. Defaults to a general set. */
+    avatarChoices?: string[];
 }
-interface Resolved extends Required<Omit<TollboothConfig, "extraBootstrapTools" | "quietTools">> {
+interface Resolved extends Required<Omit<TollboothConfig, "extraBootstrapTools" | "quietTools" | "avatarChoices">> {
     extraBootstrapTools: string[];
     quietTools: string[];
+    avatarChoices?: string[];
 }
 export declare function configureTollbooth(config: TollboothConfig): void;
 export declare function tollboothConfig(): Resolved;

package/dist/config.js

@@ -19,6 +19,7 @@ export function configureTollbooth(config) {
         mcpUrl: config.mcpUrl,
         extraBootstrapTools: config.extraBootstrapTools ?? [],
         quietTools: config.quietTools ?? [],
+        avatarChoices: config.avatarChoices,
     };
 }
 export function tollboothConfig() {

package/dist/debugLog.d.ts

@@ -1,18 +1,50 @@
 /**
- * An in-memory activity log of MCP calls, for a site's debug panel.
+ * An activity log of MCP calls, for a site's debug panel.
  *
  * A ring buffer with subscribers, so the one `callTool` can push and any panel
- * can listen. It survives route changes and is gone on reload. Arguments are
- * logged only as the wrapper's own parameters — the npub/proof envelope is
- * added after logging, so no proof ever lands here.
+ * can listen. Newest first. It survives route changes; with
+ * `configureDebugLog({ persist: true })` it survives a reload too, so an error
+ * that flips the view can still be read and copied afterward.
+ *
+ * Every message is scrubbed on the way in: an nsec, a 64-hex key, a bearer
+ * token, and the value of any secret-named field (dpop_token, proof, poison,
+ * password, api_key, …) never reach the buffer, the clipboard or storage.
+ * That is the one guarantee a panel relies on — it renders what is here.
+ *
+ * Merged from the fleet's copies (goodearth, beesknees, cypher, excalibur,
+ * optionality, roastify, taxsort). None of them scrubbed; this one does.
  */
 export interface DebugEntry {
     ts: string;
     type: "info" | "call" | "result" | "error";
     message: string;
 }
+export interface DebugLogOptions {
+    /** How many entries to keep. Default 200. */
+    max?: number;
+    /** Keep the log in localStorage so it outlives a reload. Default false. */
+    persist?: boolean;
+}
+/**
+ * Scrub secrets from a log line. Deliberately over-eager: a 64-hex event id
+ * is hidden along with a hex private key, because the two look alike.
+ */
+export declare function redact(message: string): string;
+/** Set the cap and persistence. Call after `configureTollbooth`. */
+export declare function configureDebugLog(options: DebugLogOptions): void;
 export declare function debugPush(type: DebugEntry["type"], message: string): void;
 export declare function clearDebug(): void;
+/** The entries, newest first. The same array until the log changes. */
 export declare function debugEntries(): readonly DebugEntry[];
 /** Subscribe to changes. Returns an unsubscribe function. */
 export declare function onDebug(fn: () => void): () => void;
+/** The whole log as plain text, newest first — for Copy and bug reports. */
+export declare function debugLogText(): string;
+export type DebugSeverity = "ok" | "notice" | "failure";
+/** How a panel should flag an entry: a fault, a patron's next step, or neither. */
+export declare function debugSeverity(entry: DebugEntry): DebugSeverity;
+/**
+ * Fold uncaught errors and promise rejections into the log, once per page
+ * (guarded, so StrictMode and remounts do not double-register).
+ */
+export declare function captureGlobalErrors(): void;

package/dist/debugLog.js

@@ -1,29 +1,195 @@
 /**
- * An in-memory activity log of MCP calls, for a site's debug panel.
+ * An activity log of MCP calls, for a site's debug panel.
  *
  * A ring buffer with subscribers, so the one `callTool` can push and any panel
- * can listen. It survives route changes and is gone on reload. Arguments are
- * logged only as the wrapper's own parameters — the npub/proof envelope is
- * added after logging, so no proof ever lands here.
+ * can listen. Newest first. It survives route changes; with
+ * `configureDebugLog({ persist: true })` it survives a reload too, so an error
+ * that flips the view can still be read and copied afterward.
+ *
+ * Every message is scrubbed on the way in: an nsec, a 64-hex key, a bearer
+ * token, and the value of any secret-named field (dpop_token, proof, poison,
+ * password, api_key, …) never reach the buffer, the clipboard or storage.
+ * That is the one guarantee a panel relies on — it renders what is here.
+ *
+ * Merged from the fleet's copies (goodearth, beesknees, cypher, excalibur,
+ * optionality, roastify, taxsort). None of them scrubbed; this one does.
  */
-const log = [];
+import { tollboothConfig } from "./config.js";
+const DEFAULT_MAX = 200;
+let max = DEFAULT_MAX;
+let persist = false;
+// Replaced, never mutated, so a snapshot reader (useSyncExternalStore) sees a
+// new array exactly when something changed.
+let log = [];
 const listeners = new Set();
-const MAX = 60;
-export function debugPush(type, message) {
-    log.unshift({ ts: new Date().toLocaleTimeString(), type, message });
-    if (log.length > MAX)
-        log.length = MAX;
+// ── Redaction ──────────────────────────────────────────────────────────────
+const REDACTED = "[redacted]";
+/** Field names whose value is a secret wherever it appears. */
+const SECRET_FIELD = "(?:nsec|ncryptsec|dpop_token|proof|poison|password|passphrase|secret|token|authorization|api_?key|private_?key|client_secret|[a-z0-9_]*_(?:nsec|token|secret|password|passphrase|api_?key|private_?key))";
+// `"dpop_token":"…"`, `\"dpop_token\":\"…\"` (JSON inside a JSON string),
+// `dpop_token=…` (a query string) and `dpop_token: '…'` (a Python repr). A
+// quoted value is taken whole, spaces and all; a bare one up to a delimiter.
+function fieldValue(names) {
+    return new RegExp(`((?:\\\\*["'])?\\b${names}(?:\\\\*["'])?\\s*[:=]\\s*)(?:(\\\\*["'])[^"'\\\\]*|[^"'\\\\,}\\]&\\s]+)`, "gi");
+}
+const FIELD_VALUE = fieldValue(SECRET_FIELD);
+// update_patron_credential / update_operator_credential carry the secret as
+// `value` beside a `field` naming it, so any `value` in such a call goes too.
+const CREDENTIAL_VALUE = fieldValue("value");
+const HAS_FIELD = /\\*["']field\\*["']\s*:/i;
+const NSEC = /\b(?:nsec|ncryptsec)1[02-9ac-hj-np-z]{20,}/gi;
+const HEX_KEY = /\b[0-9a-f]{64,}\b/gi; // keys, and signatures (128)
+const BEARER = /\bBearer\s+[A-Za-z0-9._~+/=-]+/g;
+function scrubbed(_match, head, quote) {
+    return `${head}${quote ?? ""}${REDACTED}`;
+}
+/**
+ * Scrub secrets from a log line. Deliberately over-eager: a 64-hex event id
+ * is hidden along with a hex private key, because the two look alike.
+ */
+export function redact(message) {
+    let out = message
+        .replace(NSEC, REDACTED)
+        .replace(BEARER, `Bearer ${REDACTED}`)
+        .replace(FIELD_VALUE, scrubbed);
+    if (HAS_FIELD.test(out))
+        out = out.replace(CREDENTIAL_VALUE, scrubbed);
+    return out.replace(HEX_KEY, REDACTED);
+}
+// ── Storage (best effort) ──────────────────────────────────────────────────
+function storageKey(name) {
+    try {
+        return `${tollboothConfig().storagePrefix}:${name}`;
+    }
+    catch {
+        return null; // not configured yet: nothing to read or write
+    }
+}
+function readLocal(name) {
+    const k = storageKey(name);
+    if (!k)
+        return null;
+    try {
+        return globalThis.localStorage?.getItem(k) ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+function writeLocal(name, value) {
+    const k = storageKey(name);
+    if (!k)
+        return;
+    try {
+        globalThis.localStorage?.setItem(k, value);
+    }
+    catch {
+        /* quota or blocked site data — the in-memory log still works */
+    }
+}
+const LOG_KEY = "debug-log:v1";
+function save() {
+    if (persist)
+        writeLocal(LOG_KEY, JSON.stringify(log));
+}
+function hydrate() {
+    try {
+        const parsed = JSON.parse(readLocal(LOG_KEY) ?? "[]");
+        if (!Array.isArray(parsed))
+            return [];
+        return parsed
+            .filter((e) => !!e && typeof e.message === "string" && typeof e.ts === "string")
+            .map((e) => ({ ts: e.ts, type: e.type, message: redact(e.message) }));
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * The patron's display zone, if the site stores one under `<prefix>:timezone`
+ * ("auto" or absent means the browser's own), so stamps match the rest of the UI.
+ */
+function stamp(now) {
+    try {
+        const pref = readLocal("timezone");
+        const zone = pref && pref !== "auto" ? pref : undefined;
+        return now.toLocaleTimeString(undefined, zone ? { timeZone: zone } : undefined);
+    }
+    catch {
+        return now.toLocaleTimeString();
+    }
+}
+function emit() {
+    save();
     listeners.forEach((fn) => fn());
 }
+// ── API ────────────────────────────────────────────────────────────────────
+/** Set the cap and persistence. Call after `configureTollbooth`. */
+export function configureDebugLog(options) {
+    if (options.max !== undefined) {
+        if (!Number.isInteger(options.max) || options.max < 1)
+            throw new Error("max must be a positive integer");
+        max = options.max;
+    }
+    if (options.persist !== undefined) {
+        persist = options.persist;
+        if (persist)
+            log = [...log, ...hydrate()];
+    }
+    log = log.slice(0, max);
+    emit();
+}
+export function debugPush(type, message) {
+    log = [{ ts: stamp(new Date()), type, message: redact(String(message)) }, ...log].slice(0, max);
+    emit();
+}
 export function clearDebug() {
-    log.length = 0;
-    listeners.forEach((fn) => fn());
+    log = [];
+    emit();
 }
+/** The entries, newest first. The same array until the log changes. */
 export function debugEntries() {
     return log;
 }
 /** Subscribe to changes. Returns an unsubscribe function. */
 export function onDebug(fn) {
     listeners.add(fn);
-    return () => listeners.delete(fn);
+    return () => {
+        listeners.delete(fn);
+    };
+}
+/** The whole log as plain text, newest first — for Copy and bug reports. */
+export function debugLogText() {
+    return log.map((e) => `${e.ts}  ${e.type.toUpperCase()}  ${e.message}`).join("\n");
+}
+// Auth and funding outcomes are situations, not faults: the service answered
+// correctly and the patron has a step to take (sign in, top up). These SDK
+// error codes read as a notice and stay out of the failure count.
+const NOTICE_CODE = /error_code\\?"\s*:\s*\\?"(npub_missing|proof_missing|proof_required|proof_refresh_needed|dpop_token_missing|oauth_not_yet_authorized|oauth_token_expired|upstream_auth_refresh_needed|insufficient_balance|authority_insufficient_balance|upstream_subscription_required|operator_llm_unfunded)\\?"/i;
+function isFailure(entry) {
+    if (entry.type === "error")
+        return true;
+    if (entry.type !== "result")
+        return false;
+    const m = entry.message;
+    return m.includes('"success":false') || m.includes('"ok":false') || m.includes('"error"') || m.includes("error_code");
+}
+/** How a panel should flag an entry: a fault, a patron's next step, or neither. */
+export function debugSeverity(entry) {
+    if (!isFailure(entry))
+        return "ok";
+    return NOTICE_CODE.test(entry.message) ? "notice" : "failure";
+}
+// ── Page-wide capture ──────────────────────────────────────────────────────
+let captured = false;
+/**
+ * Fold uncaught errors and promise rejections into the log, once per page
+ * (guarded, so StrictMode and remounts do not double-register).
+ */
+export function captureGlobalErrors() {
+    if (captured || typeof globalThis.addEventListener !== "function")
+        return;
+    captured = true;
+    globalThis.addEventListener("error", (e) => debugPush("error", `window.error: ${e.message}`));
+    globalThis.addEventListener("unhandledrejection", (e) => debugPush("error", `unhandledrejection: ${String(e.reason)}`));
 }

package/dist/index.d.ts

@@ -3,10 +3,12 @@ export { callTool, callToolWithContent, onProofExpired, ProofRequiredError, type
 export type { ImageBlock } from "./toolResult.ts";
 export * from "./identity.ts";
 export * from "./standardTools.ts";
-export { clearSessionNsec, getSessionNsec, hasSessionNsec, sessionNsecNpub, setSessionNsec, } from "./sessionNsec.ts";
+export { clearSessionNsec, getSessionNsec, getSessionNsecBytes, hasSessionNsec, sessionNsecNpub, setSessionNsec, } from "./sessionNsec.ts";
 export { signInlineProof } from "./inlineProof.ts";
+export { sessionKeyClaimVisible } from "./sessionKeyClaim.ts";
+export { handOffMode, shareOrDownload, type ShareOutcome } from "./shareFile.ts";
 export { canSignFor, isProven, type Claim } from "./signedIn.ts";
 export { readSignInFailure, type Situation } from "./signInSituation.ts";
 export { canSignProfile, fetchProfile, publishProfile } from "./nostrProfile.ts";
 export * from "./avatar.ts";
-export { clearDebug, debugEntries, debugPush, onDebug, type DebugEntry } from "./debugLog.ts";
+export { captureGlobalErrors, clearDebug, configureDebugLog, debugEntries, debugLogText, debugPush, debugSeverity, onDebug, redact, type DebugEntry, type DebugLogOptions, type DebugSeverity, } from "./debugLog.ts";

package/dist/index.js

@@ -2,10 +2,12 @@ export { configureTollbooth, tollboothConfig, toolName } from "./config.js";
 export { callTool, callToolWithContent, onProofExpired, ProofRequiredError, } from "./client.js";
 export * from "./identity.js";
 export * from "./standardTools.js";
-export { clearSessionNsec, getSessionNsec, hasSessionNsec, sessionNsecNpub, setSessionNsec, } from "./sessionNsec.js";
+export { clearSessionNsec, getSessionNsec, getSessionNsecBytes, hasSessionNsec, sessionNsecNpub, setSessionNsec, } from "./sessionNsec.js";
 export { signInlineProof } from "./inlineProof.js";
+export { sessionKeyClaimVisible } from "./sessionKeyClaim.js";
+export { handOffMode, shareOrDownload } from "./shareFile.js";
 export { canSignFor, isProven } from "./signedIn.js";
 export { readSignInFailure } from "./signInSituation.js";
 export { canSignProfile, fetchProfile, publishProfile } from "./nostrProfile.js";
 export * from "./avatar.js";
-export { clearDebug, debugEntries, debugPush, onDebug } from "./debugLog.js";
+export { captureGlobalErrors, clearDebug, configureDebugLog, debugEntries, debugLogText, debugPush, debugSeverity, onDebug, redact, } from "./debugLog.js";

package/dist/nostrProfile.d.ts

@@ -10,4 +10,4 @@ import { type Kind0, type PublishNostrProfileResult } from "./standardTools.ts";
 export declare function canSignProfile(): boolean;
 export declare function fetchProfile(npub: string): Promise<Kind0 | null>;
 /** Sign a kind-0 in the browser and have the wheel relay it. */
-export declare function publishProfile(content: Kind0): Promise<PublishNostrProfileResult>;
+export declare function publishProfile(npub: string, content: Kind0): Promise<PublishNostrProfileResult>;

package/dist/nostrProfile.js

@@ -6,7 +6,6 @@
  * hands the signed event over. No nsec ever goes to a server.
  */
 import { finalizeEvent } from "nostr-tools";
-import { getStoredNpub } from "./identity.js";
 import { getSessionNsecBytes, hasSessionNsec } from "./sessionNsec.js";
 import { getNostrProfile, publishNostrProfile, } from "./standardTools.js";
 function nip07() {
@@ -26,7 +25,7 @@ export async function fetchProfile(npub) {
     }
 }
 /** Sign a kind-0 in the browser and have the wheel relay it. */
-export async function publishProfile(content) {
+export async function publishProfile(npub, content) {
     const clean = {};
     for (const [k, v] of Object.entries(content)) {
         if (typeof v === "string" && v.trim())
@@ -50,5 +49,5 @@ export async function publishProfile(content) {
     else {
         throw new Error("No signer available — sign in with a session key or a NIP-07 extension to publish your Nostr profile.");
     }
-    return publishNostrProfile(getStoredNpub(), JSON.stringify(signed));
+    return publishNostrProfile(npub, JSON.stringify(signed));
 }

package/dist/react/AvatarPicker.js

@@ -6,7 +6,7 @@ import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-run
  */
 import { useEffect, useState } from "react";
 import { Loader2 } from "lucide-react";
-import { AVATAR_CHOICES } from "../avatar.js";
+import { avatarChoices } from "../avatar.js";
 import Avatar from "./Avatar.js";
 import { errBox, input, muted } from "./ui.js";
 const COLLECTIONS = [
@@ -60,5 +60,5 @@ export default function AvatarPicker({ value, onChange }) {
     return (_jsxs("div", { children: [_jsx("div", { className: "flex gap-2 mb-3 text-xs", children: ["catalog", "glyphs"].map((t) => (_jsx("button", { type: "button", onClick: () => setTab(t), className: `px-3 py-1.5 rounded-full transition-colors ${tab === t ? "bg-[var(--tb-accent)] text-[var(--tb-on-accent)]" : `${muted} hover:bg-[var(--tb-surface-2)]`}`, children: t === "catalog" ? "Catalog" : "Glyphs" }, t))) }), tab === "catalog" && (_jsxs(_Fragment, { children: [_jsxs("div", { className: "flex items-center gap-2 mb-3", children: [_jsx("select", { value: collection, onChange: (e) => setCollection(e.target.value), className: `${input} py-1.5 text-xs font-sans`, children: COLLECTIONS.map((c) => (_jsx("option", { value: c.prefix, children: c.label }, c.prefix))) }), !loading && !error && names.length > 0 && (_jsxs("span", { className: `text-xs whitespace-nowrap ${muted}`, children: [page + 1, "/", totalPages] }))] }), loading && (_jsxs("p", { className: `flex items-center justify-center gap-1.5 py-6 text-xs ${muted}`, children: [_jsx(Loader2, { className: "h-3.5 w-3.5 animate-spin" }), " Loading catalog\u2026"] })), error && _jsxs("div", { className: errBox, children: ["Couldn't reach Iconify: ", error] }), !loading && !error && (_jsxs(_Fragment, { children: [_jsx("div", { className: "grid grid-cols-10 gap-1.5", children: visible.map((name) => {
                                     const url = iconUrl(collection, name);
                                     return (_jsx("button", { type: "button", onClick: () => onChange(url), title: name.replace(/-/g, " "), className: tile(value === url), children: _jsx("img", { src: url, alt: name, loading: "lazy", className: "h-full w-full object-contain" }) }, name));
-                                }) }), _jsxs("div", { className: "flex items-center justify-center gap-3 mt-3 text-xs", children: [_jsx("button", { type: "button", onClick: () => setPage((p) => Math.max(0, p - 1)), disabled: page === 0, className: "px-3 py-1 rounded-full border border-[var(--tb-line)] disabled:opacity-30", children: "\u2190 Prev" }), _jsx("button", { type: "button", onClick: () => setPage((p) => Math.min(totalPages - 1, p + 1)), disabled: page >= totalPages - 1, className: "px-3 py-1 rounded-full border border-[var(--tb-line)] disabled:opacity-30", children: "Next \u2192" })] })] }))] })), tab === "glyphs" && (_jsx("div", { className: "grid grid-cols-10 gap-1.5", children: AVATAR_CHOICES.map((glyph) => (_jsx("button", { type: "button", onClick: () => onChange(glyph), className: `${tile(value === glyph)} text-lg`, children: glyph }, glyph))) })), _jsxs("details", { className: "mt-3", children: [_jsx("summary", { className: `text-xs uppercase tracking-wider cursor-pointer ${muted}`, children: "Custom (image URL or glyph)" }), _jsx("input", { type: "text", value: value, onChange: (e) => onChange(e.target.value), placeholder: "https://\u2026 or a single emoji", className: `mt-2 ${input} py-1.5 text-xs` })] }), value && (_jsxs("div", { className: "mt-4 flex items-center gap-3", children: [_jsx(Avatar, { value: value, size: 48 }), _jsx("span", { className: `text-xs ${muted}`, children: "Selected \u2014 applies immediately." })] }))] }));
+                                }) }), _jsxs("div", { className: "flex items-center justify-center gap-3 mt-3 text-xs", children: [_jsx("button", { type: "button", onClick: () => setPage((p) => Math.max(0, p - 1)), disabled: page === 0, className: "px-3 py-1 rounded-full border border-[var(--tb-line)] disabled:opacity-30", children: "\u2190 Prev" }), _jsx("button", { type: "button", onClick: () => setPage((p) => Math.min(totalPages - 1, p + 1)), disabled: page >= totalPages - 1, className: "px-3 py-1 rounded-full border border-[var(--tb-line)] disabled:opacity-30", children: "Next \u2192" })] })] }))] })), tab === "glyphs" && (_jsx("div", { className: "grid grid-cols-10 gap-1.5", children: avatarChoices().map((glyph) => (_jsx("button", { type: "button", onClick: () => onChange(glyph), className: `${tile(value === glyph)} text-lg`, children: glyph }, glyph))) })), _jsxs("details", { className: "mt-3", children: [_jsx("summary", { className: `text-xs uppercase tracking-wider cursor-pointer ${muted}`, children: "Custom (image URL or glyph)" }), _jsx("input", { type: "text", value: value, onChange: (e) => onChange(e.target.value), placeholder: "https://\u2026 or a single emoji", className: `mt-2 ${input} py-1.5 text-xs` })] }), value && (_jsxs("div", { className: "mt-4 flex items-center gap-3", children: [_jsx(Avatar, { value: value, size: 48 }), _jsx("span", { className: `text-xs ${muted}`, children: "Selected \u2014 applies immediately." })] }))] }));
 }

package/dist/react/DebugPanel.d.ts

@@ -0,0 +1,28 @@
+/**
+ * The on-screen MCP activity log — a bar fixed to the bottom of the page that
+ * shows every call, result and error, so anyone can see what the front end is
+ * doing and paste it into a bug report.
+ *
+ * Collapsed it is one tab whose colour says whether anything failed (red) or
+ * is waiting on the patron (a notice: sign in, top up). Open, it lists the log
+ * newest first with Copy and Clear. Everything shown comes from the scrubbed
+ * store, so no nsec, proof or token can be painted here.
+ *
+ * `children` is the site's own section — eXcalibur puts its scheduler controls
+ * there — drawn above the log while the panel is open.
+ *
+ * Touch-first: every control is a real button at least 40px square, nothing
+ * hides behind hover, and the page under the bar stays tappable.
+ */
+import { type ReactNode } from "react";
+export interface DebugPanelProps {
+    /** The tab's label. Default "Debug". */
+    title?: string;
+    /** Open on first visit; afterwards the patron's last choice wins. */
+    defaultOpen?: boolean;
+    /** Fold uncaught errors and proof expiries into the log. Default true. */
+    captureErrors?: boolean;
+    /** The site's own section, shown above the log while open. */
+    children?: ReactNode;
+}
+export default function DebugPanel({ title, defaultOpen, captureErrors, children, }: DebugPanelProps): import("react").JSX.Element;

package/dist/react/DebugPanel.js

@@ -0,0 +1,81 @@
+import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/**
+ * The on-screen MCP activity log — a bar fixed to the bottom of the page that
+ * shows every call, result and error, so anyone can see what the front end is
+ * doing and paste it into a bug report.
+ *
+ * Collapsed it is one tab whose colour says whether anything failed (red) or
+ * is waiting on the patron (a notice: sign in, top up). Open, it lists the log
+ * newest first with Copy and Clear. Everything shown comes from the scrubbed
+ * store, so no nsec, proof or token can be painted here.
+ *
+ * `children` is the site's own section — eXcalibur puts its scheduler controls
+ * there — drawn above the log while the panel is open.
+ *
+ * Touch-first: every control is a real button at least 40px square, nothing
+ * hides behind hover, and the page under the bar stays tappable.
+ */
+import { useEffect, useState } from "react";
+import { onProofExpired } from "../client.js";
+import { captureGlobalErrors, clearDebug, debugLogText, debugPush, debugSeverity, } from "../debugLog.js";
+import { readStored, writeStored } from "../storage.js";
+import { useDebugLog } from "./useDebugLog.js";
+const OPEN_KEY = "debug-open";
+const TYPE_INK = {
+    info: "text-[var(--tb-accent)]",
+    call: "text-[var(--tb-warn-ink)]",
+    result: "text-[var(--tb-ok)]",
+    error: "text-[var(--tb-err-ink)]",
+};
+const FLAGGED = {
+    failure: { row: "bg-[var(--tb-err-bg)]", ink: "text-[var(--tb-err-ink)] font-bold" },
+    notice: { row: "bg-[var(--tb-notice-bg)]", ink: "text-[var(--tb-notice-ink)]" },
+};
+const tab = "min-h-10 min-w-10 rounded-t-lg px-4 text-xs font-medium border border-b-0 transition-colors";
+const plainTab = `${tab} bg-[var(--tb-surface-2)] text-[var(--tb-ink)] border-[var(--tb-line)]`;
+export default function DebugPanel({ title = "Debug", defaultOpen = false, captureErrors = true, children, }) {
+    const log = useDebugLog();
+    const [open, setOpen] = useState(() => {
+        const saved = readStored(OPEN_KEY);
+        return saved === "" ? defaultOpen : saved === "1";
+    });
+    const [copied, setCopied] = useState("");
+    useEffect(() => {
+        if (!captureErrors)
+            return;
+        captureGlobalErrors();
+        return onProofExpired((msg) => debugPush("info", `proof expired → back to sign-in: ${msg}`));
+    }, [captureErrors]);
+    useEffect(() => {
+        if (!copied)
+            return;
+        const id = setTimeout(() => setCopied(""), 1500);
+        return () => clearTimeout(id);
+    }, [copied]);
+    function toggle() {
+        const next = !open;
+        setOpen(next);
+        writeStored(OPEN_KEY, next ? "1" : "0");
+    }
+    function copy() {
+        const text = debugLogText();
+        const clip = globalThis.navigator?.clipboard;
+        if (!clip) {
+            setCopied("failed");
+            return;
+        }
+        clip.writeText(text).then(() => setCopied("ok"), () => setCopied("failed"));
+    }
+    const failures = log.filter((e) => debugSeverity(e) === "failure").length;
+    const notices = log.filter((e) => debugSeverity(e) === "notice").length;
+    const toggleTone = failures > 0
+        ? "bg-[var(--tb-err-bg)] text-[var(--tb-err-ink)] border-[var(--tb-err-line)]"
+        : notices > 0
+            ? "bg-[var(--tb-notice-bg)] text-[var(--tb-notice-ink)] border-[var(--tb-notice-line)]"
+            : "bg-[var(--tb-surface-2)] text-[var(--tb-ink)] border-[var(--tb-line)]";
+    return (_jsxs("div", { className: "pointer-events-none fixed inset-x-0 bottom-0 z-50 flex flex-col items-end", children: [_jsxs("div", { className: "pointer-events-auto flex flex-wrap justify-end gap-1 pr-3", children: [open && (_jsxs(_Fragment, { children: [_jsx("button", { type: "button", onClick: copy, className: plainTab, "aria-label": "Copy the whole log", children: copied === "ok" ? "Copied" : copied === "failed" ? "Copy failed" : "Copy" }), _jsx("button", { type: "button", onClick: clearDebug, className: plainTab, children: "Clear" })] })), _jsxs("button", { type: "button", onClick: toggle, "aria-expanded": open, className: `${tab} ${toggleTone}`, children: [open ? "Hide" : title, " (", log.length, failures > 0 ? ` · ${failures} err` : "", notices > 0 ? ` · ${notices} notice` : "", ")"] })] }), open && (_jsxs("div", { className: "pointer-events-auto max-h-[40vh] w-full overflow-y-auto border-t border-[var(--tb-line)] bg-[var(--tb-surface)] p-3 font-mono text-xs text-[var(--tb-ink)]", children: [children && _jsx("div", { className: "mb-2 border-b border-[var(--tb-line)] pb-2 font-sans", children: children }), log.length === 0 && _jsx("div", { className: "text-[var(--tb-muted)]", children: "No MCP activity yet." }), log.map((entry, i) => {
+                        const sev = debugSeverity(entry);
+                        const flag = sev === "ok" ? null : FLAGGED[sev];
+                        return (_jsxs("div", { className: `-mx-1 flex gap-2 rounded px-1 py-0.5 ${flag?.row ?? ""}`, children: [_jsx("span", { className: "shrink-0 text-[var(--tb-muted)]", children: entry.ts }), _jsxs("span", { className: `w-14 shrink-0 ${flag?.ink ?? TYPE_INK[entry.type]}`, children: [sev === "notice" ? "notice" : entry.type, sev === "failure" && entry.type !== "error" ? " !" : ""] }), _jsx("span", { className: `min-w-0 break-all ${flag?.ink ?? ""}`, children: entry.message })] }, log.length - i));
+                    })] }))] }));
+}

package/dist/react/NostrProfilePanel.d.ts

@@ -3,6 +3,9 @@
  * and avatar. Edits publish a new signed kind-0, visible in every Nostr client.
  * Without a signer the fields are read-only and the action explains why.
  */
-export default function NostrProfilePanel({ npub }: {
+import type { Kind0 } from "../standardTools.ts";
+export default function NostrProfilePanel({ npub, onPublished, }: {
     npub: string;
+    /** After relays accept the kind-0 — for a site that mirrors the name or avatar elsewhere. */
+    onPublished?: (profile: Kind0) => void;
 }): import("react").JSX.Element;

package/dist/react/NostrProfilePanel.js

@@ -20,7 +20,7 @@ const FIELDS = [
     { key: "website", label: "Website", placeholder: "https://…" },
     { key: "about", label: "About", placeholder: "A short bio…" },
 ];
-export default function NostrProfilePanel({ npub }) {
+export default function NostrProfilePanel({ npub, onPublished, }) {
     const { appName } = tollboothConfig();
     const [profile, setProfile] = useState({});
     const [loading, setLoading] = useState(true);
@@ -37,6 +37,9 @@ export default function NostrProfilePanel({ npub }) {
     const explainer = howToSetExplainer(appName);
     useEffect(() => {
         let live = true;
+        // A new npub starts empty, so no field of the last patron's survives
+        // into theirs while the relays are read.
+        setProfile({});
         setLoading(true);
         fetchProfile(npub)
             .then((p) => {
@@ -86,7 +89,7 @@ export default function NostrProfilePanel({ npub }) {
         const picture = profile.picture ?? "";
         const glyph = picture !== "" && !isAvatarUrl(picture);
         try {
-            const r = await publishProfile({
+            const r = await publishProfile(npub, {
                 ...profile,
                 name: profile.display_name,
                 // kind-0 picture is a URL; a glyph stays local to this site.
@@ -95,8 +98,10 @@ export default function NostrProfilePanel({ npub }) {
             const tail = glyph ? " (Emoji avatar kept local — a Nostr picture must be a URL.)" : "";
             if (r.error)
                 setMsg({ ok: false, text: r.error });
-            else if ((r.ok ?? 0) > 0)
+            else if ((r.ok ?? 0) > 0) {
                 setMsg({ ok: true, text: `Published to ${r.ok}/${r.total} relays.${tail}` });
+                onPublished?.(profile);
+            }
             else
                 setMsg({ ok: false, text: `No relay accepted the event.${tail}` });
         }
@@ -107,10 +112,10 @@ export default function NostrProfilePanel({ npub }) {
             setPublishing(false);
         }
     }
-    return (_jsxs("div", { className: `${card} p-4`, children: [_jsxs("div", { className: "flex items-start gap-3", children: [_jsxs("div", { className: "relative flex-none", children: [_jsx(Avatar, { value: profile.picture || avatarFor(npub), size: 56 }), _jsx("button", { type: "button", onClick: () => {
+    return (_jsxs("div", { className: `${card} px-4 py-3`, children: [_jsxs("div", { className: "flex items-start gap-3", children: [_jsxs("div", { className: "relative flex-none", children: [_jsx(Avatar, { value: profile.picture || avatarFor(npub), size: 56 }), _jsx("button", { type: "button", onClick: () => {
                                     setExpanded(true);
                                     setShowPicker((v) => !v);
-                                }, "aria-label": showPicker ? "Done changing avatar" : "Change avatar", "aria-expanded": showPicker, className: "absolute -bottom-0.5 -right-0.5 inline-flex h-6 w-6 items-center justify-center rounded-full border border-[var(--tb-line)] bg-[var(--tb-surface)] shadow-sm", children: _jsx(Camera, { className: "h-3.5 w-3.5", "aria-hidden": "true" }) })] }), _jsxs("div", { className: "min-w-0 flex-1", children: [_jsxs("div", { className: "flex items-center gap-2 flex-wrap", children: [_jsx("div", { className: "text-sm font-medium truncate", children: collapsedDisplayName(profile.display_name ?? "") }), mode === "how-to-set" && (_jsx("span", { className: `text-[11px] px-1.5 py-0.5 rounded-md bg-[var(--tb-surface-2)] ${muted}`, children: "Read-only" }))] }), _jsx("button", { type: "button", onClick: copyNpub, title: "Copy full npub", className: `mt-0.5 font-mono text-xs ${muted}`, children: copied ? "Copied" : shortNpub(npub) })] }), _jsxs("button", { type: "button", onClick: () => setExpanded((v) => !v), "aria-expanded": expanded, "aria-controls": fieldsId, className: "flex-none inline-flex items-center gap-1 rounded-full border border-[var(--tb-line)] px-2.5 py-1.5 text-xs", children: [expanded ? "Hide" : "Edit", _jsx(ChevronDown, { className: `h-3.5 w-3.5 transition-transform ${expanded ? "rotate-180" : ""}`, "aria-hidden": "true" })] })] }), showPicker && (_jsx("div", { className: "mt-3", children: _jsx(AvatarPicker, { value: profile.picture ?? "", onChange: pickAvatar }) })), loading ? (_jsxs("div", { className: `flex items-center gap-1.5 text-xs py-2 mt-3 ${muted}`, children: [_jsx(Loader2, { className: "h-3.5 w-3.5 animate-spin" }), " Reading from relays\u2026"] })) : (_jsxs("div", { id: fieldsId, hidden: !expanded, className: expanded ? "mt-4 space-y-3" : undefined, children: [FIELDS.map((f) => (_jsxs("label", { className: `block text-xs ${muted}`, children: [f.label, f.key === "about" ? (_jsx("textarea", { value: profile[f.key] ?? "", onChange: (e) => set(f.key, e.target.value), rows: 2, className: `mt-1 ${input} font-sans resize-none`, placeholder: f.placeholder, readOnly: mode === "how-to-set" })) : (_jsx("input", { value: profile[f.key] ?? "", onChange: (e) => set(f.key, e.target.value), className: `mt-1 ${input} font-sans`, placeholder: f.placeholder, readOnly: mode === "how-to-set" }))] }, f.key))), msg && (_jsx("div", { className: `text-xs ${msg.ok ? "text-[var(--tb-ok)]" : "text-[var(--tb-err-ink)]"}`, children: msg.text })), _jsxs("div", { className: "relative flex items-center gap-3", ref: howToRef, children: [_jsx("button", { type: "button", onClick: () => (mode === "how-to-set" ? setShowHowTo((v) => !v) : void publish()), disabled: publishControlDisabled(mode, publishing), "aria-haspopup": mode === "how-to-set" ? "dialog" : undefined, "aria-expanded": mode === "how-to-set" ? showHowTo : undefined, className: mode === "publish"
+                                }, "aria-label": showPicker ? "Done changing avatar" : "Change avatar", "aria-expanded": showPicker, className: "absolute -bottom-0.5 -right-0.5 inline-flex h-6 w-6 items-center justify-center rounded-full border border-[var(--tb-line)] bg-[var(--tb-surface)] shadow-sm", children: _jsx(Camera, { className: "h-3.5 w-3.5", "aria-hidden": "true" }) })] }), _jsxs("div", { className: "min-w-0 flex-1", children: [_jsxs("div", { className: "flex items-center gap-2 flex-wrap", children: [_jsx("div", { className: "text-sm font-medium truncate", children: collapsedDisplayName(profile.display_name ?? "") }), mode === "how-to-set" && (_jsx("span", { className: `text-[11px] px-1.5 py-0.5 rounded-md bg-[var(--tb-surface-2)] ${muted}`, children: "Read-only" }))] }), _jsx("button", { type: "button", onClick: copyNpub, title: "Copy full npub", className: `mt-0.5 font-mono text-xs ${muted}`, children: copied ? "Copied" : shortNpub(npub) })] }), _jsxs("button", { type: "button", onClick: () => setExpanded((v) => !v), "aria-expanded": expanded, "aria-controls": fieldsId, className: "flex-none inline-flex items-center gap-1 rounded-full border border-[var(--tb-line)] px-2.5 py-1.5 text-xs", children: [expanded ? "Hide" : "Edit", _jsx(ChevronDown, { className: `h-3.5 w-3.5 transition-transform ${expanded ? "rotate-180" : ""}`, "aria-hidden": "true" })] })] }), showPicker && (_jsx("div", { className: "mt-3", children: _jsx(AvatarPicker, { value: profile.picture ?? "", onChange: pickAvatar }) })), loading ? (_jsxs("div", { className: `flex items-center gap-1.5 text-xs py-2 mt-3 ${muted}`, children: [_jsx(Loader2, { className: "h-3.5 w-3.5 animate-spin" }), " Reading from relays\u2026"] })) : (_jsxs("div", { id: fieldsId, hidden: !expanded, className: expanded ? "mt-3 grid gap-x-3 gap-y-2 sm:grid-cols-2" : undefined, children: [FIELDS.map((f) => (_jsxs("label", { className: `block text-xs ${muted} ${f.key === "about" ? "sm:col-span-2" : ""}`, children: [f.label, f.key === "about" ? (_jsx("textarea", { value: profile[f.key] ?? "", onChange: (e) => set(f.key, e.target.value), rows: 2, className: `mt-1 ${input} font-sans resize-none`, placeholder: f.placeholder, readOnly: mode === "how-to-set" })) : (_jsx("input", { value: profile[f.key] ?? "", onChange: (e) => set(f.key, e.target.value), className: `mt-1 ${input} font-sans`, placeholder: f.placeholder, readOnly: mode === "how-to-set" }))] }, f.key))), msg && (_jsx("div", { className: `text-xs sm:col-span-2 ${msg.ok ? "text-[var(--tb-ok)]" : "text-[var(--tb-err-ink)]"}`, children: msg.text })), _jsxs("div", { className: "relative flex items-center gap-3 sm:col-span-2", ref: howToRef, children: [_jsx("button", { type: "button", onClick: () => (mode === "how-to-set" ? setShowHowTo((v) => !v) : void publish()), disabled: publishControlDisabled(mode, publishing), "aria-haspopup": mode === "how-to-set" ? "dialog" : undefined, "aria-expanded": mode === "how-to-set" ? showHowTo : undefined, className: mode === "publish"
                                     ? "rounded-full bg-[var(--tb-accent)] px-4 py-2 text-sm font-medium text-[var(--tb-on-accent)] disabled:opacity-40"
                                     : "rounded-full border border-[var(--tb-line)] px-4 py-2 text-sm", children: publishControlLabel(mode, publishing) }), showHowTo && mode === "how-to-set" && (_jsxs("div", { role: "dialog", "aria-modal": "false", "aria-labelledby": explainerId, className: `${card} absolute left-0 bottom-full z-20 mb-2 w-[min(100%,22rem)] p-3 shadow-lg`, children: [_jsxs("div", { className: "flex items-start justify-between gap-2 mb-2", children: [_jsx("div", { id: explainerId, className: "text-sm font-medium", children: explainer.title }), _jsx("button", { type: "button", onClick: () => setShowHowTo(false), "aria-label": "Close", className: muted, children: _jsx(X, { className: "h-3.5 w-3.5", "aria-hidden": "true" }) })] }), _jsx("div", { className: `space-y-2 text-xs leading-relaxed ${muted}`, children: explainer.paragraphs.map((p) => (_jsx("p", { children: p }, p.slice(0, 24)))) })] }))] })] }))] }));
 }

package/dist/react/SessionKeyClaim.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Claim your session key — for a patron whose browser holds their nsec.
+ *
+ * Renders ONLY when this browser holds the session nsec for the signed-in
+ * npub. NIP-07 and courier-proof sign-ins see nothing: no disabled control,
+ * no placeholder, no mention. Reveal takes a deliberate second step so an
+ * account page opened in front of other people does not paint the key.
+ *
+ * Destinations: copy, download .env, password-manager prompt, and an
+ * encrypted DM to another npub the patron names. The nsec never reaches a
+ * log, error text, analytics call, or MCP tool argument.
+ */
+export default function SessionKeyClaim({ npub }: {
+    npub: string;
+}): import("react").JSX.Element | null;

package/dist/react/SessionKeyClaim.js

@@ -0,0 +1,212 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/**
+ * Claim your session key — for a patron whose browser holds their nsec.
+ *
+ * Renders ONLY when this browser holds the session nsec for the signed-in
+ * npub. NIP-07 and courier-proof sign-ins see nothing: no disabled control,
+ * no placeholder, no mention. Reveal takes a deliberate second step so an
+ * account page opened in front of other people does not paint the key.
+ *
+ * Destinations: copy, download .env, password-manager prompt, and an
+ * encrypted DM to another npub the patron names. The nsec never reaches a
+ * log, error text, analytics call, or MCP tool argument.
+ */
+import { useRef, useState } from "react";
+import { tollboothConfig } from "../config.js";
+import { passwordManagerOutcomeLabel, sessionKeyClaimVisible, sessionKeyEnvContents, sessionKeyEnvFilename, } from "../sessionKeyClaim.js";
+import { sendSessionKeyDm } from "../sessionKeyDm.js";
+import { getSessionNsec, getSessionNsecBytes, hasSessionNsec, sessionNsecNpub, } from "../sessionNsec.js";
+import { shareOrDownload } from "../shareFile.js";
+import { card, input, muted } from "./ui.js";
+export default function SessionKeyClaim({ npub }) {
+    const visible = sessionKeyClaimVisible({
+        hasSessionNsec: hasSessionNsec(),
+        sessionNsecNpub: sessionNsecNpub(),
+        signedInNpub: npub,
+    });
+    // Hard requirement: silence when the browser does not hold the key.
+    if (!visible)
+        return null;
+    return _jsx(SessionKeyClaimInner, {});
+}
+function SessionKeyClaimInner() {
+    const { slug, appName } = tollboothConfig();
+    const envFilename = sessionKeyEnvFilename(slug);
+    const [revealed, setRevealed] = useState(false);
+    const [showKey, setShowKey] = useState(false);
+    const [copied, setCopied] = useState(false);
+    const [dmOpen, setDmOpen] = useState(false);
+    const [recipient, setRecipient] = useState("");
+    const [busy, setBusy] = useState(false);
+    const [flash, setFlash] = useState(null);
+    const formRef = useRef(null);
+    const userRef = useRef(null);
+    const passRef = useRef(null);
+    function nsecOrThrow() {
+        const nsec = getSessionNsec();
+        if (!nsec)
+            throw new Error("No session key in this browser.");
+        return nsec;
+    }
+    function note(tone, text) {
+        // Deliberately never interpolate the nsec into flash text.
+        setFlash({ tone, text });
+    }
+    async function copyKey() {
+        setBusy(true);
+        setFlash(null);
+        try {
+            const nsec = nsecOrThrow();
+            await navigator.clipboard.writeText(nsec);
+            setCopied(true);
+            window.setTimeout(() => setCopied(false), 1500);
+            note("ok", "Copied. It is on your clipboard only — paste it somewhere you trust.");
+        }
+        catch {
+            note("err", "Could not copy. Your browser may have blocked the clipboard.");
+        }
+        finally {
+            setBusy(false);
+        }
+    }
+    async function downloadEnv() {
+        setBusy(true);
+        setFlash(null);
+        try {
+            const nsec = nsecOrThrow();
+            const body = sessionKeyEnvContents(slug, nsec);
+            const file = new File([body], envFilename, {
+                type: "text/plain",
+            });
+            const outcome = await shareOrDownload(file, `${appName} session key`);
+            if (outcome === "cancelled") {
+                note("ok", "Share cancelled — nothing left this page.");
+            }
+            else if (outcome === "blocked") {
+                note("err", "The share sheet needs a fresh tap. Try Download again.");
+            }
+            else if (outcome === "shared") {
+                note("ok", "Handed off via the share sheet.");
+            }
+            else {
+                note("ok", `Downloaded ${envFilename}. Import it yourself — the page did not write to any keychain.`);
+            }
+        }
+        catch {
+            note("err", "Could not prepare the download.");
+        }
+        finally {
+            setBusy(false);
+        }
+    }
+    async function passwordManagerSave() {
+        setBusy(true);
+        setFlash(null);
+        try {
+            const nsec = nsecOrThrow();
+            const outcome = await offerPasswordManager(nsec, npubHint(), `${appName} session key`, formRef.current, userRef.current, passRef.current);
+            note("ok", passwordManagerOutcomeLabel(outcome));
+        }
+        catch {
+            note("err", passwordManagerOutcomeLabel("unsupported"));
+        }
+        finally {
+            setBusy(false);
+        }
+    }
+    function npubHint() {
+        // Username for a password manager entry — the public npub, never secret.
+        return sessionNsecNpub() ?? `${slug}-session`;
+    }
+    async function sendDm() {
+        setBusy(true);
+        setFlash(null);
+        try {
+            const nsec = nsecOrThrow();
+            const to = recipient.trim();
+            if (!to.startsWith("npub1") || to.length < 60) {
+                note("err", "Enter the recipient as an npub1… address.");
+                return;
+            }
+            const result = await sendSessionKeyDm({
+                appName,
+                nsecBytes: getSessionNsecBytes(),
+                nsecBech32: nsec,
+                recipientNpub: to,
+            });
+            if (result.ok > 0) {
+                note("ok", `Encrypted DM accepted by ${result.ok}/${result.total} relays. Open it from the recipient’s Nostr client.`);
+                setDmOpen(false);
+                setRecipient("");
+            }
+            else {
+                note("err", "No relay accepted the encrypted DM. Try again in a moment.");
+            }
+        }
+        catch (e) {
+            // Message must stay free of the nsec — our thrown errors already are.
+            const msg = e.message || "Could not send the DM.";
+            note("err", msg.includes("nsec") ? "Could not send the DM." : msg);
+        }
+        finally {
+            setBusy(false);
+        }
+    }
+    if (!revealed) {
+        return (_jsxs("div", { className: `${card} px-4 py-3`, children: [_jsx("div", { className: "eyebrow mb-1", children: "Session key" }), _jsxs("div", { className: "flex flex-wrap items-center gap-x-4 gap-y-2", children: [_jsx("p", { className: `min-w-[14rem] flex-1 text-[12.5px] leading-snug ${muted}`, children: "This browser is holding the secret key that signs you in. Take a copy before you clear site data or switch devices \u2014 without it, this identity is gone." }), _jsx("button", { type: "button", onClick: () => setRevealed(true), className: "min-h-11 shrink-0 rounded-full border border-[var(--tb-accent)] bg-[var(--tb-accent)] px-4 text-[13px] font-semibold text-[var(--tb-on-accent)]", children: "Claim your session key" })] })] }));
+    }
+    return (_jsxs("div", { className: `relative ${card} px-4 py-3`, children: [_jsxs("div", { className: "flex flex-wrap items-baseline justify-between gap-2", children: [_jsx("div", { className: "eyebrow mb-1", children: "Session key" }), _jsx("button", { type: "button", onClick: () => {
+                            setRevealed(false);
+                            setShowKey(false);
+                            setDmOpen(false);
+                            setFlash(null);
+                            setRecipient("");
+                        }, className: `text-[12px] ${muted} hover:text-[var(--tb-ink)]`, children: "Hide" })] }), _jsxs("p", { className: `mb-3 text-[12.5px] leading-relaxed ${muted}`, children: ["Anyone who holds this key is you. It leaves this page only when you choose a destination below \u2014 never logged, never sent to ", appName, "."] }), showKey ? (_jsx("div", { className: "mb-3 break-all rounded-lg border border-[var(--tb-line)] bg-[var(--tb-surface-2)] px-3 py-2 font-mono text-[12px] text-[var(--tb-ink)]", children: getSessionNsec() })) : (_jsx("button", { type: "button", onClick: () => setShowKey(true), className: `mb-3 text-[12.5px] ${muted} underline-offset-2 hover:text-[var(--tb-ink)] hover:underline`, children: "Show the key on screen" })), _jsxs("div", { className: "flex flex-wrap gap-2", children: [_jsx(DestButton, { onClick: () => void copyKey(), disabled: busy, children: copied ? "Copied" : "Copy" }), _jsx(DestButton, { onClick: () => void downloadEnv(), disabled: busy, children: "Download .env" }), _jsx(DestButton, { onClick: () => void passwordManagerSave(), disabled: busy, children: "Password manager" }), _jsx(DestButton, { onClick: () => {
+                            setDmOpen((v) => !v);
+                            setFlash(null);
+                        }, disabled: busy, active: dmOpen, children: "Send by DM" })] }), dmOpen && (_jsxs("div", { className: "mt-3 space-y-2 rounded-lg border border-[var(--tb-line)] bg-[var(--tb-surface-2)] p-3", children: [_jsx("p", { className: `text-[12px] leading-relaxed ${muted}`, children: "Encrypts the key to an npub you own and publishes the sealed message to public relays. Only that npub can open it." }), _jsxs("div", { className: "flex flex-wrap items-end gap-2", children: [_jsxs("label", { className: `block min-w-[16rem] flex-1 text-[12px] ${muted}`, children: ["Recipient npub", _jsx("input", { value: recipient, onChange: (e) => setRecipient(e.target.value), spellCheck: false, autoCapitalize: "off", autoCorrect: "off", placeholder: "npub1\u2026", className: `mt-1 h-11 ${input}` })] }), _jsx("button", { type: "button", onClick: () => void sendDm(), disabled: busy || recipient.trim().length < 60, className: "min-h-11 shrink-0 rounded-full border border-[var(--tb-accent)] bg-[var(--tb-accent)] px-4 text-[13px] font-semibold text-[var(--tb-on-accent)] disabled:opacity-40", children: busy ? "Sending…" : "Send encrypted DM" })] })] })), _jsxs("form", { ref: formRef, className: "absolute h-px w-px overflow-hidden opacity-0", "aria-hidden": "true", autoComplete: "on", onSubmit: (e) => {
+                    e.preventDefault();
+                }, children: [_jsx("input", { ref: userRef, name: "username", autoComplete: "username", defaultValue: "", readOnly: true, tabIndex: -1 }), _jsx("input", { ref: passRef, name: "password", type: "password", autoComplete: "new-password", defaultValue: "", readOnly: true, tabIndex: -1 })] }), flash && (_jsx("p", { className: `mt-3 text-[12.5px] leading-relaxed ${flash.tone === "ok" ? "text-[var(--tb-ink)]" : "text-[var(--tb-err-ink)]"}`, role: "status", children: flash.text }))] }));
+}
+function DestButton({ onClick, disabled, active, children, }) {
+    return (_jsx("button", { type: "button", onClick: onClick, disabled: disabled, className: `min-h-11 shrink-0 rounded-full border px-3.5 text-[12.5px] font-medium disabled:opacity-40 ${active
+            ? "border-[var(--tb-accent)] bg-[var(--tb-accent)] text-[var(--tb-on-accent)]"
+            : `border-[var(--tb-line)] ${muted} active:bg-[var(--tb-surface-2)]`}`, children: children }));
+}
+/**
+ * Offer the key to a browser password manager. Never claims an OS keychain.
+ * Uses PasswordCredential when available; otherwise fills a hidden form and
+ * submits it so the browser can offer a save prompt.
+ */
+async function offerPasswordManager(nsec, username, name, form, user, pass) {
+    const Cred = window
+        .PasswordCredential;
+    if (Cred && navigator.credentials?.store) {
+        try {
+            const cred = new Cred({
+                id: username,
+                password: nsec,
+                name,
+            });
+            await navigator.credentials.store(cred);
+            return "stored";
+        }
+        catch {
+            // Fall through to the form prompt.
+        }
+    }
+    // Form-based prompt — best-effort. Many browsers ignore programmatic submit
+    // for save prompts; we still report honestly that we only prompted.
+    if (form && user && pass) {
+        user.value = username;
+        pass.value = nsec;
+        if (typeof form.requestSubmit === "function")
+            form.requestSubmit();
+        else
+            form.submit();
+        // Clear the DOM value immediately so a later inspect does not show it.
+        pass.value = "";
+        return "prompted";
+    }
+    return "unsupported";
+}

package/dist/react/index.d.ts

@@ -1,6 +1,9 @@
 export { default as Avatar } from "./Avatar.tsx";
 export { default as AvatarPicker } from "./AvatarPicker.tsx";
+export { default as DebugPanel, type DebugPanelProps } from "./DebugPanel.tsx";
 export { default as NpubGate } from "./NpubGate.tsx";
 export { default as NostrProfilePanel } from "./NostrProfilePanel.tsx";
+export { default as SessionKeyClaim } from "./SessionKeyClaim.tsx";
 export { default as WalletCard } from "./WalletCard.tsx";
 export { useSession, type Session } from "./useSession.ts";
+export { useDebugLog } from "./useDebugLog.ts";

package/dist/react/index.js

@@ -1,6 +1,9 @@
 export { default as Avatar } from "./Avatar.js";
 export { default as AvatarPicker } from "./AvatarPicker.js";
+export { default as DebugPanel } from "./DebugPanel.js";
 export { default as NpubGate } from "./NpubGate.js";
 export { default as NostrProfilePanel } from "./NostrProfilePanel.js";
+export { default as SessionKeyClaim } from "./SessionKeyClaim.js";
 export { default as WalletCard } from "./WalletCard.js";
 export { useSession } from "./useSession.js";
+export { useDebugLog } from "./useDebugLog.js";

package/dist/react/useDebugLog.d.ts

@@ -0,0 +1,6 @@
+/**
+ * The debug log's entries, newest first, re-rendering whenever they change.
+ * Entries are already scrubbed of secrets by `debugPush`.
+ */
+import { type DebugEntry } from "../debugLog.ts";
+export declare function useDebugLog(): readonly DebugEntry[];

package/dist/react/useDebugLog.js

@@ -0,0 +1,9 @@
+/**
+ * The debug log's entries, newest first, re-rendering whenever they change.
+ * Entries are already scrubbed of secrets by `debugPush`.
+ */
+import { useSyncExternalStore } from "react";
+import { debugEntries, onDebug } from "../debugLog.js";
+export function useDebugLog() {
+    return useSyncExternalStore(onDebug, debugEntries, debugEntries);
+}

package/dist/sessionKeyClaim.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Claiming the session key — the pure rules behind the SessionKeyClaim card.
+ *
+ * The hard requirement: show nothing unless THIS browser holds the key for
+ * the npub that is signed in. A patron on NIP-07 or a courier proof must
+ * never see a claim that the site holds their key.
+ *
+ * A patron exporting their OWN key is self-addressed by construction; what
+ * the ecosystem forbids is a service leaking keys, not a person claiming one.
+ */
+/** True only when the browser holds the session nsec for the signed-in npub. */
+export declare function sessionKeyClaimVisible(opts: {
+    hasSessionNsec: boolean;
+    sessionNsecNpub: string | null;
+    signedInNpub: string;
+}): boolean;
+/** The variable a site's key goes under, e.g. "GOODEARTH_NSEC". */
+export declare function sessionKeyEnvName(slug: string): string;
+/** Contents of the downloadable `.env` hand-off. */
+export declare function sessionKeyEnvContents(slug: string, nsec: string): string;
+/** Suggested filename for the `.env` hand-off, e.g. "goodearth-nsec.env". */
+export declare function sessionKeyEnvFilename(slug: string): string;
+/**
+ * What the password-manager destination may honestly report.
+ * A web page cannot write to an OS keychain; say what actually happened.
+ */
+export type PasswordManagerOutcome = "stored" | "prompted" | "unsupported";
+export declare function passwordManagerOutcomeLabel(o: PasswordManagerOutcome): string;

package/dist/sessionKeyClaim.js

@@ -0,0 +1,40 @@
+/**
+ * Claiming the session key — the pure rules behind the SessionKeyClaim card.
+ *
+ * The hard requirement: show nothing unless THIS browser holds the key for
+ * the npub that is signed in. A patron on NIP-07 or a courier proof must
+ * never see a claim that the site holds their key.
+ *
+ * A patron exporting their OWN key is self-addressed by construction; what
+ * the ecosystem forbids is a service leaking keys, not a person claiming one.
+ */
+/** True only when the browser holds the session nsec for the signed-in npub. */
+export function sessionKeyClaimVisible(opts) {
+    const signedIn = opts.signedInNpub.trim();
+    if (!signedIn || !opts.hasSessionNsec)
+        return false;
+    const held = opts.sessionNsecNpub?.trim() ?? "";
+    return held !== "" && held === signedIn;
+}
+/** The variable a site's key goes under, e.g. "GOODEARTH_NSEC". */
+export function sessionKeyEnvName(slug) {
+    return `${slug.toUpperCase()}_NSEC`;
+}
+/** Contents of the downloadable `.env` hand-off. */
+export function sessionKeyEnvContents(slug, nsec) {
+    return `${sessionKeyEnvName(slug)}=${nsec}\n`;
+}
+/** Suggested filename for the `.env` hand-off, e.g. "goodearth-nsec.env". */
+export function sessionKeyEnvFilename(slug) {
+    return `${slug}-nsec.env`;
+}
+export function passwordManagerOutcomeLabel(o) {
+    switch (o) {
+        case "stored":
+            return "Offered to your browser’s password manager.";
+        case "prompted":
+            return "Submitted so your browser’s password manager can offer to save it. Nothing was written to an OS keychain — a web page cannot do that.";
+        case "unsupported":
+            return "This browser has no password-manager save path the page can reach. Download the .env file or copy the key instead.";
+    }
+}

package/dist/sessionKeyDm.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Ship the browser-held session nsec to another npub the patron names.
+ *
+ * Client-side only: encrypt (NIP-17 gift wrap over NIP-44), sign, and publish
+ * the wrap to public relays. The plaintext nsec never enters an MCP tool
+ * argument, a log line, or an error message — only ciphertext leaves the page.
+ *
+ * Why not the wheel's relay transport: publish_nostr_profile accepts kind-0
+ * only, and there is no patron-facing generic "publish this signed event"
+ * tool in the wheel. Encryption must happen here anyway (the nsec is the
+ * sender key and the payload); relay fan-out of an already-signed kind-1059
+ * is the remaining hop, done with nostr-tools' SimplePool.
+ */
+/** Public write relays used for the gift-wrapped DM fan-out. */
+export declare const SESSION_KEY_DM_RELAYS: readonly ["wss://relay.damus.io", "wss://nos.lol", "wss://relay.primal.net", "wss://offchain.pub"];
+/** Plaintext body of the DM. Kept short; the nsec is the payload. */
+export declare function sessionKeyDmBody(appName: string, nsec: string): string;
+export declare function recipientPubkeyHex(npubBech32: string): string;
+export interface SessionKeyDmResult {
+    ok: number;
+    total: number;
+    /** Relay URLs that accepted the wrap — never includes plaintext. */
+    accepted: string[];
+    /** Short per-relay failure notes — never includes plaintext. */
+    errors: string[];
+}
+/**
+ * Gift-wrap `nsecBech32` to `recipientNpub` and publish the kind-1059 wrap.
+ * Throws on bad input; relay failures are reported in the result, not thrown.
+ */
+export declare function sendSessionKeyDm(opts: {
+    appName: string;
+    nsecBytes: Uint8Array;
+    nsecBech32: string;
+    recipientNpub: string;
+    relays?: readonly string[];
+    /** Injected for tests — real path builds a SimplePool. */
+    publish?: (wrap: {
+        id: string;
+    }, relays: readonly string[]) => Promise<SessionKeyDmResult>;
+}): Promise<SessionKeyDmResult>;

package/dist/sessionKeyDm.js

@@ -0,0 +1,83 @@
+/**
+ * Ship the browser-held session nsec to another npub the patron names.
+ *
+ * Client-side only: encrypt (NIP-17 gift wrap over NIP-44), sign, and publish
+ * the wrap to public relays. The plaintext nsec never enters an MCP tool
+ * argument, a log line, or an error message — only ciphertext leaves the page.
+ *
+ * Why not the wheel's relay transport: publish_nostr_profile accepts kind-0
+ * only, and there is no patron-facing generic "publish this signed event"
+ * tool in the wheel. Encryption must happen here anyway (the nsec is the
+ * sender key and the payload); relay fan-out of an already-signed kind-1059
+ * is the remaining hop, done with nostr-tools' SimplePool.
+ */
+import { nip19 } from "nostr-tools";
+import { wrapEvent } from "nostr-tools/nip17";
+import { SimplePool } from "nostr-tools/pool";
+/** Public write relays used for the gift-wrapped DM fan-out. */
+export const SESSION_KEY_DM_RELAYS = [
+    "wss://relay.damus.io",
+    "wss://nos.lol",
+    "wss://relay.primal.net",
+    "wss://offchain.pub",
+];
+/** Plaintext body of the DM. Kept short; the nsec is the payload. */
+export function sessionKeyDmBody(appName, nsec) {
+    return [
+        `Your ${appName} session key (nsec).`,
+        "Anyone who holds it is you — import it only into a client you control.",
+        "",
+        nsec,
+    ].join("\n");
+}
+export function recipientPubkeyHex(npubBech32) {
+    const trimmed = npubBech32.trim();
+    if (!trimmed.startsWith("npub1")) {
+        throw new Error("Recipient must be an npub1… address.");
+    }
+    const decoded = nip19.decode(trimmed);
+    if (decoded.type !== "npub") {
+        throw new Error("Recipient must be an npub1… address.");
+    }
+    // nostr-tools v2 returns the 32-byte x-only pubkey as a hex string.
+    const data = decoded.data;
+    if (typeof data === "string" && /^[0-9a-f]{64}$/i.test(data))
+        return data;
+    throw new Error("Could not read that npub.");
+}
+/**
+ * Gift-wrap `nsecBech32` to `recipientNpub` and publish the kind-1059 wrap.
+ * Throws on bad input; relay failures are reported in the result, not thrown.
+ */
+export async function sendSessionKeyDm(opts) {
+    const recipient = recipientPubkeyHex(opts.recipientNpub);
+    const body = sessionKeyDmBody(opts.appName, opts.nsecBech32);
+    // NIP-17: kind-14 rumor sealed + gift-wrapped to the recipient.
+    const wrap = wrapEvent(opts.nsecBytes, { publicKey: recipient }, body);
+    const relays = opts.relays ?? SESSION_KEY_DM_RELAYS;
+    if (opts.publish)
+        return opts.publish(wrap, relays);
+    const pool = new SimplePool();
+    const accepted = [];
+    const errors = [];
+    try {
+        const pubs = pool.publish([...relays], wrap);
+        const settled = await Promise.allSettled(pubs);
+        settled.forEach((r, i) => {
+            const url = relays[i] ?? `relay-${i}`;
+            if (r.status === "fulfilled")
+                accepted.push(url);
+            else
+                errors.push(`${url}: refused`);
+        });
+    }
+    finally {
+        try {
+            pool.close([...relays]);
+        }
+        catch {
+            /* pool already quiet */
+        }
+    }
+    return { ok: accepted.length, total: relays.length, accepted, errors };
+}

package/dist/shareFile.d.ts

@@ -0,0 +1,6 @@
+export type ShareOutcome = "shared" | "downloaded" | "cancelled" | "blocked";
+export declare function handOffMode(o: {
+    canShareFiles: boolean;
+    coarsePointer: boolean;
+}): "share" | "download";
+export declare function shareOrDownload(file: File, title: string): Promise<ShareOutcome>;

package/dist/shareFile.js

@@ -0,0 +1,50 @@
+// Hand a file to the person holding the device.
+//
+// The share sheet on a touch-first device that has one for files — a tablet or
+// a phone, where a "download" lands in a folder nobody opens. A download
+// everywhere else.
+//
+// Desktop is decided by the POINTER, not by whether the browser offers a share
+// sheet. Chrome and Edge on Windows 11 do offer one for files, and following it
+// is why a tester's Export "did nothing": the bundle takes several calls to
+// assemble, the click that asked for it has expired by then, the sheet is
+// refused, and the page waited for a second click on a button whose changed
+// label a desktop user never notices. The Windows sheet offers Mail and Nearby
+// Share anyway, not "save this file", which is what a desktop user wanted.
+//
+// "blocked" is still its own answer on a tablet. Safari opens the sheet only
+// from a fresh tap, so the caller keeps the file and asks for one more tap,
+// which the sheet then accepts.
+/// The share sheet only on a touch-first device that can share files.
+export function handOffMode(o) {
+    return o.canShareFiles && o.coarsePointer ? "share" : "download";
+}
+export async function shareOrDownload(file, title) {
+    const nav = navigator;
+    const canShareFiles = !!nav.share && !!nav.canShare?.({ files: [file] });
+    const coarsePointer = typeof window.matchMedia === "function"
+        && window.matchMedia("(pointer: coarse)").matches;
+    if (handOffMode({ canShareFiles, coarsePointer }) === "share") {
+        try {
+            await nav.share({ files: [file], title });
+            return "shared";
+        }
+        catch (e) {
+            const name = e.name;
+            if (name === "AbortError")
+                return "cancelled";
+            if (name === "NotAllowedError")
+                return "blocked";
+            // Anything else: the sheet is broken here, so download instead.
+        }
+    }
+    const url = URL.createObjectURL(file);
+    const a = document.createElement("a");
+    a.href = url;
+    a.download = file.name;
+    document.body.appendChild(a);
+    a.click();
+    a.remove();
+    setTimeout(() => URL.revokeObjectURL(url), 10_000);
+    return "downloaded";
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tollbooth-dpyc/web",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "Shared browser SDK for Tollbooth DPYC operator front ends: npub sign-in, proofs, MCP client, profile and wallet",
   "license": "Apache-2.0",
   "author": "Lonnie VanZandt",
@@ -54,7 +54,6 @@
     "typescript": "^7.0.2"
   },
   "publishConfig": {
-    "access": "public",
-    "provenance": true
+    "access": "public"
   }
 }

package/theme.css

@@ -25,6 +25,9 @@
   --tb-err-bg: #fdecec;
   --tb-err-line: #f2b8b8;
   --tb-err-ink: #9b1c1c;
+  --tb-notice-bg: #f4ecfd;
+  --tb-notice-line: #d6bdf5;
+  --tb-notice-ink: #5b2a91;
 }
 
 @media (prefers-color-scheme: dark) {
@@ -43,5 +46,8 @@
     --tb-err-bg: #2c1515;
     --tb-err-line: #5e2525;
     --tb-err-ink: #f4a3a3;
+    --tb-notice-bg: #241532;
+    --tb-notice-line: #4d2d6e;
+    --tb-notice-ink: #d8b4fe;
   }
 }